archy/Release & Testing/Detailed Plans/02-Execution-Entry.md

Sanitized detailed source transcription S02, captured 2026-10-24. Original planning steps, acceptance criteria and historical evidence are retained rather than condensed. Read current context and precedence first: dated holds, approvals, test counts and “latest” labels below belong to their original checkpoint and do not grant current execution/publication authority. Privacy replacements preserve roles and test semantics. See section coverage.

executor: Archipelago completion — execution entry point

Current authority and priority

The operator approved the UX design subject to restoring original black modal containers, then explicitly requested completion of the execution plan and to begin development. The earlier general UX review hold is superseded for this approved scope. Latest addition: externally shared IndeeHub must support guests with no owner Archipelago wallet/signer/session/private-data authority; 09-Public-Guest-Security.md is a mandatory new gate.

Start T00 now, then contract/delivery work T01/T02 and dependency-ready implementation. This pack is execution-ready as task instructions, NOT a statement that source, contracts, artifacts or deployments already passed. The final preview modal styling pass is applied locally. Remaining domain/economic/security decisions block affected implementation/exposure, not safe independent work.

Existing authorization permits coherent qualified scoped candidate delivery to operator node through 05-Guarded-Installed-UAT.md by the authorized coordinator. It does NOT authorize automatic/new spending, paid inference, public films/comments/zaps, live public-origin exposure/DNS/firewall changes, other-node deployment, radio flash/RF changes/reboots, destructive migration/reset, key replacement, private-image publication or release publication. Obtain explicit scope for these. CI workers never deploy, merge, push main, tag, sign or publish.

Current checkpoint (2026-10-14): the prior private Y1 operator-UAT PASS is withdrawn after the operator found an old-looking interface, no Archipelago source, and a false Update badge. A corrected, headless-qualified frontend is installed on operator node but operator retest remains pending; it is release-UNQUALIFIED. Guarded backup/cutover, exact runtime and served-byte checks, delayed anti-reversion, preservation checks, 390px/1440px browse and responsive checks, film-details and sign-in keyboard/focus behavior, unauthenticated Backstage boundary, and all four anonymous upload denials passed. Authorized synthetic installed UAT also passed native sign-in, JWT/profile matching, SPA Backstage, UI private-draft creation, authenticated multipart initialize/abort, supported draft deletion and sign-out credential/native-selection clearing. Actual installed Cloud connector and complete file transfer remain NOT_RUN, with their disposable lower-layer gates passed. Canonical accepted provenance and independent high-risk review remain blockers. See [private continuity record: CURRENT-HANDOFF.md] for exact commits and artifact hashes; do not redeploy the superseded images.

Mandatory confidentiality gate — latest operator instruction

Never commit or publish infrastructure details, machine identifiers, IPs/endpoints, access configuration, passwords, keys/tokens, wallet data, sensitive personal information, raw operational evidence, or actionable private-system attack details to Git/ngit/Gitea, issues, CI logs or artifacts. This local Reports pack is NOT repository-ready; do not copy it wholesale. Use generic role labels and separately reviewed sanitized requirements when creating repository documentation.

Before any future staging/commit/proposal, require a confidentiality review of the exact diff and generated assets/logs; before publication, review the complete proposed artifact set. A clean diff does not prove history is leak-free. Discovery of sensitive content blocks publication: stop, keep findings in restricted local evidence and notify the owner; do not quote secrets or circulate exploit details. Rotation/revocation or history rewriting requires coordinated authorization.

The operator explicitly requested no confidentiality/history audit in the current coordinating session. No such audit has been performed and no claim that past history is clean is made. If requested later, use a separate isolated read-only reviewer where available, with no publication authority and sanitized findings returned; do not silently launch or claim an agent audit.

Read in order

1. [private home instructions: AGENTS.md] and repository AGENTS.md. Private infrastructure configuration stays outside repositories/logs/artifacts.
2. This file, 06-Approved-UX-and-Additions.md, AUDIT.md.
3. 03-Tasks-T00-T29.md, 04-Qualification-Test-Contract.md, 05-Guarded-Installed-UAT.md and ledger.json. Read T00-BASELINE.md for current source evidence, 07-Shared-Contracts.md before T01-dependent work, and CURRENT-HANDOFF.md for the latest clean-worktree checkpoint.
4. 09-Public-Guest-Security.md; 10-Film-Details-and-Zaps.md; 11-Mesh-Investigation-and-Acceptance.md for affected tasks.
5. Parent 01-Completion-Execution-Plan.md for retained product contract and 43 original requirements; latest authority here supersedes historical hold/no-deployment wording. Original mandatory master regression checklist remains required.
6. Only next task's mapped source/tests and primary protocol references. Do not repeatedly reload all historical handovers.

Ledger: 48 requirements (43 original + A10/A11/A12/A13/C10), 30 tasks T00–T29. All production tasks start OPEN with separate NOT_RUN gates and deployment_ready=false. Test-only preview evidence is not deployment readiness. validate-pack.py checks references/coverage/dependency cycles and ledger shape, not security or acceptance.

First execution unit

• Verify exact current accepted canonical refs and review status, full component provenance and unpublished target version. Planning observations: release checkout [private candidate checkout] at fcc18b392; IndeeHub candidate [private candidate checkout] at 5f62657039d57b581310a15eb40445afe53ab77a. Reverify; neither local existence nor branch name proves approval.
• Preserve dirty [private candidate checkout] and candidate generated-file drift. Create clean pinned task worktrees; never reset/clean or copy dirty code into CI.
• Inventory baseline harnesses and existing tests; run only permitted isolation. On installed-app machines backend tests use scripts/test-backend-isolated.sh. Compile-only cargo test --no-run is not runtime validation.
• Reconcile every retained backlog subrow to requirement/task and current evidence. Record unknowns/blockers, no broad completion percentage. Inspect current node state read-only privately before proposing delivery.
• Report source pins, review status, baseline results/failures, precise next task and blockers. Contract decisions include financial policies, guest identity/recovery and unresolved Mesh audio wording; do not invent production defaults from prototype values.

Implementation rules

Preserve original IndeeHub shell, film-details/social modal, zap amount picker, black glass containers and original player. Approved Backstage page shape stays. Extend Cloud payment components/semantics and existing profits dashboard, do not duplicate wallets or redesign screens. Do not ship static preview scripts, sample catalog/wallet data, fake QR, simulated confirm controls or app-owned imitation wallet approval.

Critical outcomes: no-BTCPay native/external all-supported-rail payment/zaps; strict authenticated FIPS remote media; durable entitlement/renewal/chunk ceiling and no repeat spend; creator-authorized global film/discussion identity; private guest access with no owner capability leakage; complete retained A–E regression and Mesh diagnosis. No unsupported Fedimint or automatic external chunk-payment promise.

Never execute legacy build:uat:archipelago unchanged: it embeds a private fixed-peer list. Replace it with reviewed dynamic discovery; do not publish private configuration. Verify current package scripts rather than inventing commands.

Operating loop and parallel work

One coordinator owns ledger and shared-file integration. At most a few independent lanes after T00; no concurrent edits to dispatcher, payment schema, common player or migration code. Give bounded tasks exact paths, expected failing test, forbidden actions and exit criteria. Model alias/pricing is not verified; choose available authorized model and log cost/time/rework. Two failed repair cycles or any money/auth/provenance ambiguity → stop and seek stronger independent review with reproducer.

Task flow: OPEN → IN_PROGRESS → IMPLEMENTED → appropriate source/integration/artifact/UAT gates, or BLOCKED. A task completion label never implies every requirement's live/physical gate passed. For each work unit record task/requirement IDs, source/test commits, commands/results, artifact hashes, review, preserved historical evidence, actual/no operator node delivery with reason, next action. New changes invalidate affected old evidence. No PASS without a linked receipt.

Keep working on independent tasks while user tests a frozen operator node batch, but never silently overwrite that batch. A failure blocks the affected delivery path until repaired/retested. Final release is separate owner-controlled ngit review/merge and exact Gitea mirroring, metadata/asset resolution and immutable artifact publication.

Required safety stops

Uncertain fund movement, unexpected signer/wallet authority, FIPS bypass, unknown source provenance, foreign lifecycle ownership, destructive rollback, lost identity/data or guest-to-owner leakage: stop rollout immediately. Preserve journal/raw evidence privately and reconcile before retry or restore. Never pay again to recover, prune unrelated storage or restore stale financial databases blindly.

Handoff prompt

Read 02-Execution-Entry.md and repository instructions. Execute T00, record exact reviewed source and baseline, then the next dependency-ready task in 03-Tasks-T00-T29.md. User approved development and guarded coherent operator node UAT, not real spending, public exposure/events/releases or other-node/hardware changes. Preserve original UI, implement real contracts rather than prototype shortcuts, and meet public-guest isolation. Update ledger evidence at every gate; stop on funds/auth/source/data uncertainty. Return changed paths, exact revisions, tests/commands/results, artifacts, delivery status, blockers and next action. Do not re-plan already-approved UX.